[Ubuntu 24.04][Upgrade] v0.0.55 to v0.0.93 leaves sandbox stuck in Provisioning; nemoclaw rebuild fails with legacy registry entry error

> [!WARNING]
> **Regression** — v0.0.55 to v0.0.76 upgrade was fixed (GH #6114, closed 2026-07-20); direct v0.0.55 to v0.0.93 upgrade re-introduces the same stuck-Provisioning symptom with an additional rebuild block not present in the original report.

## Description

Upgrading NemoClaw directly from v0.0.55 (OpenShell 0.0.44) to v0.0.93 (OpenShell 0.0.85) leaves pre-existing sandboxes permanently stuck in Provisioning phase. Unlike the similar issue fixed for v0.0.55 to v0.0.76 (GH #6114), this regression also blocks manual recovery: running `nemoclaw {sandbox} rebuild` fails with "legacy registry entry cannot distinguish a managed image from a custom --from image". The only recovery path is to destroy the sandbox and re-onboard from scratch, losing any workspace state not covered by the automatic backup.

Platform scope: Reproduced on Ubuntu 24.04.4 LTS (x86_64) only; other platforms not tested.
Regression: Yes — v0.0.55 to v0.0.76 upgrade was fixed (GH #6114, closed 2026-07-20); direct v0.0.55 to v0.0.93 upgrade re-introduces the same stuck-Provisioning symptom with an additional rebuild block not present in the original report.

## Environment

```text
Device: Ubuntu 24.04 x86_64 server
OS: Ubuntu 24.04.4 LTS
Architecture: x86_64
Node.js: v22.23.1
npm: 10.9.8
Docker: 29.6.2
OpenShell CLI: 0.0.44 (source) / 0.0.85 (after upgrade)
NemoClaw: v0.0.55 (source) / v0.0.93 (after upgrade)
OpenClaw: v2026.5.22 (in sandbox, before upgrade)
```

## Steps to Reproduce

1. Install NemoClaw v0.0.55:
```bash
curl -fsSL https://www.nvidia.com/nemoclaw.sh | NEMOCLAW_INSTALL_TAG=v0.0.55 bash
```
2. Complete onboard, creating sandbox "alpha" (openclaw agent, any provider). Confirm: `nemoclaw --version` shows v0.0.55; `openshell --version` shows 0.0.44; sandbox Phase: Ready.
3. Add a messaging channel (e.g. Slack) to trigger a sandbox rebuild, so the sandbox has an active channel before upgrade.
4. Write a workspace marker:
```bash
nemoclaw alpha exec -- bash -c "echo upgrade-test > /sandbox/.openclaw-data/workspace/marker.txt"
```
5. Upgrade directly to v0.0.93:
```bash
curl -fsSL https://www.nvidia.com/nemoclaw.sh | NEMOCLAW_INSTALL_TAG=v0.0.93 bash
```
When prompted "Confirm these were managed-image sandboxes? [y/N]:", answer y.
6. After upgrade completes, run: `nemoclaw alpha status`
7. Run: `nemoclaw alpha rebuild --yes`

## Expected Result

- Step 6: `nemoclaw alpha status` shows Phase: Ready, OpenClaw version matches expected v2026.7.1.
- Step 7: Rebuild succeeds or is not needed; sandbox is accessible and workspace/channel config is preserved.

## Actual Result

Step 6: `nemoclaw alpha status` shows Phase: Provisioning with:

```text
OpenShell: 0.0.44 (docker)
Agent: OpenClaw version not verified (expected v2026.7.1)
Update: unable to verify sandbox OpenClaw version
Run nemoclaw alpha rebuild if this sandbox predates the current install
Sandbox is stuck in Provisioning phase.
```

Sandbox container logs show repeated auth failures:

```text
Policy fetch failed after 5 attempts: no sandbox token source available
```

Step 7: `nemoclaw alpha rebuild --yes` fails immediately with:

```text
Rebuild preflight failed: recorded custom Dockerfile is invalid.
legacy registry entry cannot distinguish a managed image from a custom --from image
Sandbox is untouched — no data was lost.
```

The only recovery path is `nemoclaw alpha destroy` followed by re-onboarding.

## Logs

```text
Upgrade output (relevant excerpt):
[INFO] Retiring OpenShell 0.0.44 gateway before installing current OpenShell...
[INFO] Backing up 1 sandbox(es) before upgrading OpenShell...
Backing up alpha: 11 dirs, 1 files backed up

Post-upgrade sandbox container stderr:
Policy fetch failed after 5 attempts: no sandbox token source available

nemoclaw alpha rebuild --yes:
Rebuild preflight failed: recorded custom Dockerfile is invalid.
legacy registry entry cannot distinguish a managed image from a custom --from image
```